Page 1 of 1

Help with finding a pointer

Posted: Thu Oct 26, 2017 11:08 am
by tonka4ok
Hey guys, I've been trying to find the static address for the nitrous in need for speed most wanted 2. But as I go up in pointers manually, on the second pointer I get an instruction without offset (mov ebx, cbx etc.) so I can't trace further. I also tried pointerscan for the value with level 7 and max offset 7000 and still on second pointer scan - 0 results.. I'm kinda new tell me if I missed something and I will provide more info.

Re: Help with finding a pointer

Posted: Thu Nov 02, 2017 11:15 am
by tonka4ok
bump

Re: Help with finding a pointer

Posted: Thu Nov 02, 2017 1:08 pm
by FreeER
tonka4ok wrote:
Thu Oct 26, 2017 11:08 am
I get an instruction without offset (mov ebx, cbx etc.) so I can't trace further
if it's something like mov ebx, [eax] then the offset is 0 eg. mov ebx, [eax+0] if it's more like mov ebx, eax then look up in the code to see where eax got it's value.

Generally I prefer using assembly scripts over pointers however so I don't know too much about working with pointers when it's hard to track them down, I'd just hook something that uses it and copy the address to some memory if nothing else.

Re: Help with finding a pointer

Posted: Thu Nov 02, 2017 1:57 pm
by tonka4ok
You mean you trace down the changes from the value's memory region without looking for pointers ?

Re: Help with finding a pointer

Posted: Tue Nov 07, 2017 9:10 am
by jungletek
tonka4ok wrote:
Thu Nov 02, 2017 1:57 pm
You mean you trace down the changes from the value's memory region without looking for pointers ?
Nah, a hook for nitrous in your case would be something like this:

Find Nitro address, use find what accesses or find what writes to find a routine that updates constantly (ideal) or only when your nitro decreases/increases.

Use AutoAssembler to write an (AOBscan optional) injection where you define a global variable (let's say nitroAddress) and then write the address of nitro to [nitroAddress] before executing (or not, depending on what you're doing) the original code that you detoured with your injection.

You can then add an address to your address list in the main CE window that points to [nitroAddress] (because you defined that variable in your injection script) and it will dynamically update the address whenever the code path you hooked is executed.